amadan
carlos / platform Public
H25 removes the old-box drain requirement from the forward rollout, but not from the rollback as written. Three P2 findings and one P3:
- P2 — Destroying the group during rollback still needs settlement. Spec:352
Rollback restores the old box’s eligibility and relocates group residents before destroying the group. It never excludes the group boxes from new destinations or settles outstanding selections.
Failure scenario: a create selects a group box before rollback, pauses, then completes after its residents have been relocated. Recovery retains that executor. Destroying the group strands the instance. The post-cut-over rollback inherits this problem through step 4.
Either retain the group until spec 4, or provide the exclusion and acknowledged settlement needed to retire it safely.
- P2 — Rollback cannot relocate a never-woken group instance. Spec:352
A newly created group instance can still have Holder.Session == 0. Relocation refuses that state, and the ordinary wake path requires Holder.WriterBox to name the local box.
Failure scenario: an instance is created during rehearsal but receives no traffic. Rollback cannot return it to the old box, so it cannot safely destroy the group. A9-2 remains relevant to this sequence despite §22’s moot disposition.
Retain the group, or explicitly include support for relocating this state.
- P2 — Moves need separate source validation and destination eligibility. Spec:313
The proposed move change describes destination selection. Today, selectMoveBoxes applies the placement predicate to both regions, and the move door requires the selected source to equal the claim’s executor.
Failure scenario: after enforcing legacy/platform exclusion, an existing customer instance on the old box cannot move to another region: its executor is absent from the source candidates. Removing the multiple-box refusal alone does not fix this.
Specify that the source comes from the claim and is validated as active and unfenced; only the destination gets §7’s placement policy. Test outbound moves from both excluded roles.
- P3 — The active forwarding section still requires emptying the old box. Spec:240
This clause says §9 moves every instance off before transferring the EIP. H25 and the revised §9 explicitly retain those instances.
Failure scenario: a plan following §6 reinstates the drain prerequisite that this revision removes. Replace it with the new-address, forced-publication and reader-refresh transition.
The revised address swap covers the previously identified forwarding and relay requirements at design level. I found no additional blocker in those steps.
Reviewed platform 9c26d974 and flagship 7c99ff8f. No files changed; no builds, tests or infrastructure commands run.
---
FIRST PROMPT: Review spec 2 round 10 at the pinned HEAD against flagship tofu, read-only.
WHAT: Check H25, placement exclusion, address switching, rollback and the full spec.
STATUS: Complete; three P2 findings and one P3.
NEEDED: Nothing.
RECOMMENDED: Resolve group retirement during rollback and distinguish move-source validation from destination selection.
SESSION: Safe to close; nothing modified or left running.
Verdict: not ready for a plan.